CVEvulnerability

CVE-2026-56364

1.8 LOW Published 2026-06-30 Modified 2026-10-25 Official page ↗
Status
Analyzed
Published
2026-06-30
Last modified
2026-10-25
Assigner
[email protected]
CVSS 4.0 ([email protected])
1.8 LOW — CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
1.9 LOW — CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-401

Description

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

Affected configurations

• imagemagick imagemagick (< 7.1.2-13)

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References